Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-08-2024 15:17
General
-
Target
9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118.exe
-
Size
760KB
-
MD5
9a8b9618327be00cc39b5e592a1ee2ba
-
SHA1
bf16c27fa814d3b418f90668d769bb4b4bb6b48b
-
SHA256
f56221012c021d03c1afe39e507e6a71f3204e870579859a9450755d18c56586
-
SHA512
04450c5bc9d954b6b2ea059eb249ac344d98d5860135f851a7c7e162a710516e9c61748f6e5e0432d1e47b115a64af0a6fc771b9b554dada00fa42fc86370180
-
SSDEEP
12288:xDj9wSCOI6shw5iqo7bK0rrd6s3q6qLblPgn896CxrMRi4Ik5ioz0oi9qNkT5Mqi:xDj9XFj8w5ihZJ6s3Ubsqx41t9z/iqNZ
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9a8b9618327be00cc39b5e592a1ee2ba_jaffacakes118\9a8b9618327be00cc39b5e592a1ee2ba_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\9a8b9618327be00cc39b5e592a1ee2ba_jaffacakes118\9a8b9618327be00cc39b5e592a1ee2ba_jaffacakes118.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
760KB
MD59a8b9618327be00cc39b5e592a1ee2ba
SHA1bf16c27fa814d3b418f90668d769bb4b4bb6b48b
SHA256f56221012c021d03c1afe39e507e6a71f3204e870579859a9450755d18c56586
SHA51204450c5bc9d954b6b2ea059eb249ac344d98d5860135f851a7c7e162a710516e9c61748f6e5e0432d1e47b115a64af0a6fc771b9b554dada00fa42fc86370180
-
Filesize
54B
MD5d6bffc3ea552530d4bf6544e997e6fb5
SHA1cea465c01c5c66d24b1b1900916a6cff4b619d1d
SHA2568d3b0db37e043909e06aa69c88020c92096552621da666a0e3c36e9c7f559438
SHA51288905c7f65e5c87d59b18e554e39b3d6f59e0036af62c11a568204997f483f7982f88b59e231e18db8ce6504b4c197e85792f64d23bfbf9966b14e68857a8f8c
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
368KB
-
Filesize
4KB
-
Filesize
688KB
-
Filesize
160KB
-
Filesize
344KB
-
Filesize
952KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
784KB